10 ms·

>"Companies can't just say 'yes we only allow children over 13 to join our >platform', then they allow 10-year-olds and actively promote it to them," she >told

>"Companies can't just say 'yes we only allow children over 13 to join our >platform', then they allow 10-year-olds and actively promote it to them," she >told BBC radio. "We're stopping that from happening." >She said companies could face fines of up to 10% of their turnover if they did >not have systems in place to restrict underage access. So what does this mean? All social media websites have to check the passport of every UK user that registers? It will be illegal to post anything in a forum, without first uploading your passport?

dorwi 4y ago
that is one way of looking at it, and it's a perfectionist view. I'm sure that everybody knows that one simply can't filter out 100% of underage access, but there are things that CAN be done to reduce it.
- Ajedi32 4y ago
  Maybe it should just be an HTTP header. Shift the responsibility for enforcing age restrictions to the client side; anything else is likely to be highly authoritarian and/or a massive privacy violation.
  - waboremo 4y ago
    Surely we can come up with solutions to help ease the burden for parents/guardians instead of just leaving them out in the cold because we're offended by the mere idea of taking some collective action to prevent abuse.
    - generj 4y ago
      I believe the poster above was suggesting the client browser, not the user of the client, could assist. So Safari knows that a user is under 13 (due to information entered at sign up by guardians) and will block the user from creating an account if a page has the appropriate HTTP header. Or iOS could do the same for app signups.
      - Ajedi32 4y ago
        Correct. The problem here is two-fold: 1. Sites have no reliable way to determine a user's age without massive privacy violations. (E.g. To access this site, upload a copy of your driver's license.) 2. Making the government the final authority on who is allowed to access the adult internet would enable way too much authoritarian abuse. (E.g. Sorry citizen, you have been deemed a dissident, and will therefore now be treated like a child by every website you visit.) The solution to 1 is to handle the age verification part on the client side, so sites don't need to know anything about the user except whether they're old enough to access the content in question. And the solution for 2 is for parents to enforce access at the household level rather than governments doing it at the national level. (E.g. Don't let your kids use devices/software that lies to sites about their age, unless you're there to supervise.) The exact details of how that gets implemented at the protocol level aren't as important as the overall principle. (Though I have a few ideas.)
    - nradov 4y ago
      No thanks. As a parent, I am well aware of the risks of unintended consequences from drastic collective action by government or industry. I'll take the burden. Leave me out in the cold.
    - zaroth 4y ago
      Leaving parents out in the cold? Surely not. It’s obviously parents leaving their children out in the cold if a 10 year old is given unrestricted access to apps and the internet. There are abundant and powerful options to track, monitor, and censor content that your children are exposed to on their devices, assuming a parent chooses to provide their children access to such a device. Asking every single service everywhere to somehow gatekeep when the client-side can do it simply and easily is such a bizarre approach to solving the problem that I can only see it as an obvious and bold-fisted attempt to clamp down on anonymous speech, which is entirely essential for a functional democracy.
      - yamtaddle 4y ago
        Parent here trying to straddle the line between still having convenient tech in our house and keeping the kids from e.g. vegging out on creepily-targeted Youtube videos or stumbling on something terrible. It's a hell of a lot less simple than I thought it'd be. One wrinkle is the goddamn schools sending home devices I can't administer. Hate, hate, hate that.
        mrguyorama 4y ago
        Surely you can administer the network connection those devices use when they are in your home?
        Ajedi32 4y ago
        That's getting harder as software continues to get better at bypassing network-level snooping or content blocks (which are often done by entities like malicious Wi-Fi operators or the user's ISP, neither of which have any business deciding what content the user is allowed to see).
        yamtaddle 4y ago
        I can. Good luck to people who aren't paid to make computers jump through hoops as their day job. I'm not even necessarily saying the government should step in with heavy-handed regulation, but "parents should just manage it and leave the rest of us alone" gets less reasonable with each passing day.
    - forgotusername6 4y ago
      We are sleepwalking into a surveillance state. One day we will be forced to sign onto the internet. After that it's just a matter of time before they rachet down the civil liberties one by one.
shapefrog 4y ago
I am pretty sure a previous incarnation of this bill demanded kyc on everyone who had an online account.
Mindwipe 4y ago
Yes. It's being passed to a regulator who have suggested that you could make everyone take a selfie and use AI or something, but yes, that's the jist of it.
- ndsipa_pomu 4y ago
  That seems trivial to circumvent
kmlx 4y ago
> All social media websites have to check the passport of every UK user that registers? credit card?
- gambiting 4y ago
  Last time I checked not having a debit card is not a crime in the UK, nor is one considered a valid form of id.
  - luckylion 4y ago
    And being on an online-platform is not a right. It doesn't need to be valid form of id to be "good enough" for platforms as an age verification system. "But children could just get their parents' credit cards" ... and they could also just get their parents' passports.
    - gambiting 4y ago
      I mean, in the UK you can get a debit card from 13 years of age so I'm not sure how that helps. Credit cards no, but requiring one would exclude a massive portion of the population as they just aren't as popular. Frankly, to me that's just an argument against requiring anything to prove your age on an online platform. It shouldn't be necessary and I consider this a bad development.
      - luckylion 4y ago
        If it's 13+ that would work if the minimum age for these platforms is also 13+. It's certainly not perfect, but if implemented, it would probably not be the only way to verify your age (or it might if credit card companies are smart and pay the platforms). Germany has similar simple ways to provide pseudo-verification, e.g. they'll use direct-deposit or direct-debit to transfer a cent or three and put a code in the subject field that you'll need to enter. It's not perfect, and they wouldn't even know who you are, since account numbers aren't tied to names, but it proves (sufficiently for them to say "we really tried") that you are the account owner. While they don't know who you are, your bank has to because of KYC, and in case of trouble they could say "talk to the bank, they know who's hiding behind this username". Of course there are edge cases and ways around it, but it's enough that they get out of hot water. I don't really have an opinion on whether age should be verified. I'm past most minimum ages and I don't have children, so I'm not affected.
flipbrad 4y ago
The companies backing AVPA (age verification providers association) which include Experian, have been pushing for the child protection stuff, big time. Guess why.
- dmix 4y ago
  Backdoor national digital ID system?
  - lazide 4y ago
    Not so back door, and no need for the gov’t to get involved of course. Experian can use it’s AIMagic(tm) to do so, as long as they get access to everyone’s medical records from birth, I imagine.
  - StrictDabbler 4y ago
    No, Experian's dream is that anytime anybody online creates an account for any service at all, Experian gets to charge a "service fee" for verifying their identity. It's a capitalist desire. They're just exploiting the statists and nationalists.
mianos 4y ago
The issue gets messier when you consider what just happened in Australia, when one of the largest medical insurance providers accidentally over-shared the Excel sheet with all their passwords in it (or something like that) and now all their customer's id documents are on the dark web. I would imagine that some rando social media site that collects this stuff to prove someone is over age to be a whole lot less secure (if that is possible?).
iam-TJ 4y ago
The 'remote' aspect is the complicating factor but the basis of this is no different to other services. At the shop cash tills I noticed recently a sign that said "if you're purchasing alcohol and are fortunate enough to look under 25 we will need to age check you" (or some very similar words). Same goes for anyone buying solvents and glues, or knives and blades, vapes, etc. The aim is good - the challenge is the implementation. Only feasible way seems to be prove you're older than the minimum (which feels like persecuting those that are old enough) rather than prove you're too young!

dorwi 4y ago

that is one way of looking at it, and it's a perfectionist view. I'm sure that everybody knows that one simply can't filter out 100% of underage access, but there are things that CAN be done to reduce it.

Ajedi32 4y ago
Maybe it should just be an HTTP header. Shift the responsibility for enforcing age restrictions to the client side; anything else is likely to be highly authoritarian and/or a massive privacy violation.
- waboremo 4y ago
  Surely we can come up with solutions to help ease the burden for parents/guardians instead of just leaving them out in the cold because we're offended by the mere idea of taking some collective action to prevent abuse.
  - generj 4y ago
    I believe the poster above was suggesting the client browser, not the user of the client, could assist. So Safari knows that a user is under 13 (due to information entered at sign up by guardians) and will block the user from creating an account if a page has the appropriate HTTP header. Or iOS could do the same for app signups.
    - Ajedi32 4y ago
      Correct. The problem here is two-fold: 1. Sites have no reliable way to determine a user's age without massive privacy violations. (E.g. To access this site, upload a copy of your driver's license.) 2. Making the government the final authority on who is allowed to access the adult internet would enable way too much authoritarian abuse. (E.g. Sorry citizen, you have been deemed a dissident, and will therefore now be treated like a child by every website you visit.) The solution to 1 is to handle the age verification part on the client side, so sites don't need to know anything about the user except whether they're old enough to access the content in question. And the solution for 2 is for parents to enforce access at the household level rather than governments doing it at the national level. (E.g. Don't let your kids use devices/software that lies to sites about their age, unless you're there to supervise.) The exact details of how that gets implemented at the protocol level aren't as important as the overall principle. (Though I have a few ideas.)
  - nradov 4y ago
    No thanks. As a parent, I am well aware of the risks of unintended consequences from drastic collective action by government or industry. I'll take the burden. Leave me out in the cold.
  - zaroth 4y ago
    Leaving parents out in the cold? Surely not. It’s obviously parents leaving their children out in the cold if a 10 year old is given unrestricted access to apps and the internet. There are abundant and powerful options to track, monitor, and censor content that your children are exposed to on their devices, assuming a parent chooses to provide their children access to such a device. Asking every single service everywhere to somehow gatekeep when the client-side can do it simply and easily is such a bizarre approach to solving the problem that I can only see it as an obvious and bold-fisted attempt to clamp down on anonymous speech, which is entirely essential for a functional democracy.
    - yamtaddle 4y ago
      Parent here trying to straddle the line between still having convenient tech in our house and keeping the kids from e.g. vegging out on creepily-targeted Youtube videos or stumbling on something terrible. It's a hell of a lot less simple than I thought it'd be. One wrinkle is the goddamn schools sending home devices I can't administer. Hate, hate, hate that.
      - mrguyorama 4y ago
        Surely you can administer the network connection those devices use when they are in your home?
        Ajedi32 4y ago
        That's getting harder as software continues to get better at bypassing network-level snooping or content blocks (which are often done by entities like malicious Wi-Fi operators or the user's ISP, neither of which have any business deciding what content the user is allowed to see).
        yamtaddle 4y ago
        I can. Good luck to people who aren't paid to make computers jump through hoops as their day job. I'm not even necessarily saying the government should step in with heavy-handed regulation, but "parents should just manage it and leave the rest of us alone" gets less reasonable with each passing day.
  - forgotusername6 4y ago
    We are sleepwalking into a surveillance state. One day we will be forced to sign onto the internet. After that it's just a matter of time before they rachet down the civil liberties one by one.

shapefrog 4y ago

I am pretty sure a previous incarnation of this bill demanded kyc on everyone who had an online account.

Mindwipe 4y ago

Yes. It's being passed to a regulator who have suggested that you could make everyone take a selfie and use AI or something, but yes, that's the jist of it.

ndsipa_pomu 4y ago
That seems trivial to circumvent

kmlx 4y ago

> All social media websites have to check the passport of every UK user that registers? credit card?

gambiting 4y ago
Last time I checked not having a debit card is not a crime in the UK, nor is one considered a valid form of id.
- luckylion 4y ago
  And being on an online-platform is not a right. It doesn't need to be valid form of id to be "good enough" for platforms as an age verification system. "But children could just get their parents' credit cards" ... and they could also just get their parents' passports.
  - gambiting 4y ago
    I mean, in the UK you can get a debit card from 13 years of age so I'm not sure how that helps. Credit cards no, but requiring one would exclude a massive portion of the population as they just aren't as popular. Frankly, to me that's just an argument against requiring anything to prove your age on an online platform. It shouldn't be necessary and I consider this a bad development.
    - luckylion 4y ago
      If it's 13+ that would work if the minimum age for these platforms is also 13+. It's certainly not perfect, but if implemented, it would probably not be the only way to verify your age (or it might if credit card companies are smart and pay the platforms). Germany has similar simple ways to provide pseudo-verification, e.g. they'll use direct-deposit or direct-debit to transfer a cent or three and put a code in the subject field that you'll need to enter. It's not perfect, and they wouldn't even know who you are, since account numbers aren't tied to names, but it proves (sufficiently for them to say "we really tried") that you are the account owner. While they don't know who you are, your bank has to because of KYC, and in case of trouble they could say "talk to the bank, they know who's hiding behind this username". Of course there are edge cases and ways around it, but it's enough that they get out of hot water. I don't really have an opinion on whether age should be verified. I'm past most minimum ages and I don't have children, so I'm not affected.

flipbrad 4y ago

The companies backing AVPA (age verification providers association) which include Experian, have been pushing for the child protection stuff, big time. Guess why.

dmix 4y ago
Backdoor national digital ID system?
- lazide 4y ago
  Not so back door, and no need for the gov’t to get involved of course. Experian can use it’s AIMagic(tm) to do so, as long as they get access to everyone’s medical records from birth, I imagine.
- StrictDabbler 4y ago
  No, Experian's dream is that anytime anybody online creates an account for any service at all, Experian gets to charge a "service fee" for verifying their identity. It's a capitalist desire. They're just exploiting the statists and nationalists.

mianos 4y ago

The issue gets messier when you consider what just happened in Australia, when one of the largest medical insurance providers accidentally over-shared the Excel sheet with all their passwords in it (or something like that) and now all their customer's id documents are on the dark web. I would imagine that some rando social media site that collects this stuff to prove someone is over age to be a whole lot less secure (if that is possible?).

iam-TJ 4y ago

The 'remote' aspect is the complicating factor but the basis of this is no different to other services. At the shop cash tills I noticed recently a sign that said "if you're purchasing alcohol and are fortunate enough to look under 25 we will need to age check you" (or some very similar words). Same goes for anyone buying solvents and glues, or knives and blades, vapes, etc. The aim is good - the challenge is the implementation. Only feasible way seems to be prove you're older than the minimum (which feels like persecuting those that are old enough) rather than prove you're too young!